Sony Assures Credit Card Data Was Encrypted

Recommended Videos

geckoguy18

New member
Apr 12, 2010
3
0
0
The real issue here is that nothing else was encrypted which means this the hackers hackers have all the other information so if you use the same password for another service I would change that as well.
 

RustyCat

New member
Oct 19, 2010
6
0
0
Several dozen people have chimed in on Ars Technica stating that, since the attack, they've had suspicious activity on the cards they used for PSN.

http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars
 

Redd the Sock

New member
Apr 14, 2010
1,088
0
0
I'm actually getting tired of the same PR line. Sony, you want to re-sssure us, don't copy and paste your ealier statements. They sound rehersed enough rithout sounding like a recorded message.
 

Torrasque

New member
Aug 6, 2010
3,441
0
0
At this point, I wouldn't be surprised if Sony said this is all a hoax and everyone who owns a PS3 is getting upgraded services tomorrow.
No wait! The upgraded services are only available to people who called the Q&A line!
No wait! The Q&A line was hacked into and everyone who called the Q&A line has to do a funny dance or all their golds will be stoleded!
No wait! Everything is fine because the Q&A line was encrypted and nothing really happened!

Still sitting back playing my xbox, laughing at Sony =)
 

Tron Paul

New member
Dec 11, 2009
42
0
0
This is the company who's root key on the PS3 was leaked. Let's just say when even the best encryption algorithms can be cracked, Sony's isn't the best. Also why the hell were passwords in plaintext? That's just dumb.
 

Emergent

New member
Oct 26, 2010
234
0
0
This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).

Why counter it? Because they're potentially liable for billions.
 

danintexas

New member
Jul 30, 2010
372
0
0
Ever use a credit card at any store? - Or in fact have you ever removed your credit card from your wallet?

You are in a greater threat handing your card to a waiter in a restaurant than something happening with this crap. Who uses a bank these days that doesn't fix these issues in the matter of a couple days.

Just had my card duped last month - Over $3000 was stolen from my account. 1 call to my bank and it was back in 2 days time and 5 days later I had a new card. Not really a life ending event. If your bank doesn't work like this you need to get a better one.
 

DanielBrown

Dangerzone!
Dec 3, 2010
3,837
0
0
Well, no matter the outcome, I'm glad I got my old, non-functioning credit card entered in my PSN.
 

midpipps

New member
Feb 23, 2009
328
0
0
SharedProphet said:
Didn't help Shamus' brother [http://www.shamusyoung.com/twentysidedtale/?p=11467]...
I love how you say this but

UPDATE: While the PSN notification about the breech arrived in the same morning as the news of my brother?s credit card theft, there are other factors in play here that point elsewhere. It?s impossible to say for sure, but let?s not lay the blame for this on Sony just yet.
is right at the bottom of that article. Don't get me wrong there is definitely a possibility and people should definitely be vigilante but I wonder how many claims are just happenstance as opposed to actual. Then again I only ever used store bought psn cards on my account if I have the choice that is the way I will always go and I do the same thing on XBL and anyother online places if possible. Otherwise wallmart prepaid cards are great.
 

midpipps

New member
Feb 23, 2009
328
0
0
PettingZOOPONY said:
Just yesterday it was revealed by their own security experts the cards were kept in plain text. Wtf is going on.
Do you have a link to this I would love to read that. Cause that is web transaction 101 if they really did store them as plain text then they are definitely negligent in this aspect.
 

Wolfram23

New member
Mar 23, 2004
4,095
0
0
Sent to 77 million users, but they forgot me on their list? Fuckers.

*Captcha: "covers angsnoin" what?
 

PettingZOOPONY

New member
Dec 2, 2007
423
0
0
midpipps said:
PettingZOOPONY said:
Just yesterday it was revealed by their own security experts the cards were kept in plain text. Wtf is going on.
Do you have a link to this I would love to read that. Cause that is web transaction 101 if they really did store them as plain text then they are definitely negligent in this aspect.
I'll dig it up, people are already using the stolen info which indicates there was 0 encryption involved.
 

wooty

Vi Britannia
Aug 1, 2009
4,252
0
0
DanielBrown said:
I'm glad I got my old, non-functioning credit card entered in my PSN.
Hmmm, you may have just relieved some worry from my own mind there, I dont think I've used my new card on PSN since getting it issued a few months ago. I only wish I could access the network to find out now
 

mireko

Umbasa
Sep 23, 2010
2,003
0
0
Emergent said:
This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).

Why counter it? Because they're potentially liable for billions.
Oh, that story again. Says nothing about how the PSN stored user information. The threat they're outlining is that someone could steal this information as it's being transmitted from a PS3 to the PSN if you're on a CFW that someone has really fucked up.

A document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection. So far so good; this is all safe, and your web browser depends on the same mechanisms for online purchases.

The concern raised by the hackers is that custom firmwares could subvert this system. A custom firmware can include custom certificates in its trusted list. It can also use custom DNS servers. This raises the prospect of a malicious entity operating his own proxies to snaffle sensitive data. He would distribute a custom firmware that had a certificate corresponding to his proxy, and that used a DNS server that directed PSN connections to the proxy. His proxy would decrypt the data sent to it, and then re-encrypt it and forward it to the real PSN servers.

Such a scheme would be transparent to PSN users (except for any potential performance reduction caused by the proxying), and would give the attacker access to all the information that the PS3 sends to Sony. This information is shown to be extensive, but apart from the credit card data, probably not too sensitive or unreasonable.

As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk. Essentially the same risk could be faced by anyone downloading a pirated version of Windows: extra certificates could be added to those normally trusted, along with suitable DNS entries, to allow interception of any traffic destined for, say, amazon.com. In practice, the risk of either of these is slight, and in any case, trivially avoided: don't use custom firmware.
Ars

Ars was pretty alarmist about that whole thing too, until someone in the comments actually put it to the test and provided the information with which they updated the article.

Obviously, someone did grab credit card and user information anyway, but it wasn't a result of how the PS3 sent this information to the servers. Until we get some clear explanations from Sony about the attack (ha ha), we can't just assume they had this stuff in plaintext.
 

meece

New member
Apr 15, 2008
239
0
0
Actually I can't help but applaud them "Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network."

How much guts does that take to say to a horde of angry people? Impressive, true, and admirable as opposed to hoping people don't notice they never asked for it.

This can happen to anyone and yes, you're in more threat from your average card reader in a restaurant/store I reckon then a company like Sony being hacked.
 

EchetusXe

New member
Jun 19, 2008
1,046
0
0
*Checks bank account online.*

Several hundred pounds spent on online pornography.

Nothing out of order there then. Maybe the hackers haven't tried using my information yet.